This paper presents an unsupervised learning approach for anomaly detection in industrial control systems (ICSs). The study addresses the challenges of detecting anomalies in complex ICS environments, which are characterized by diverse equipment from multiple vendors, proprietary protocols, and limited access to real-world environments. The proposed method uses a composite autoencoder model to identify anomalous behavior without the need for pre-labeled data. The model is trained on a dataset augmented with hardware-in-the-loop (HIL) simulations, which accurately reflects real ICS operations. The study demonstrates that the model can effectively detect and classify anomalous behavior, both in single and multivariate variables, and at microscopic levels. The performance of the model is evaluated using various metrics, including accuracy, precision, recall, and F1 score, showing high overall performance. The research contributes to enhancing the security and reliability of ICSs by providing a robust and cost-effective solution for anomaly detection. Future work will focus on identifying different types of attacks based on real-world measurement data.This paper presents an unsupervised learning approach for anomaly detection in industrial control systems (ICSs). The study addresses the challenges of detecting anomalies in complex ICS environments, which are characterized by diverse equipment from multiple vendors, proprietary protocols, and limited access to real-world environments. The proposed method uses a composite autoencoder model to identify anomalous behavior without the need for pre-labeled data. The model is trained on a dataset augmented with hardware-in-the-loop (HIL) simulations, which accurately reflects real ICS operations. The study demonstrates that the model can effectively detect and classify anomalous behavior, both in single and multivariate variables, and at microscopic levels. The performance of the model is evaluated using various metrics, including accuracy, precision, recall, and F1 score, showing high overall performance. The research contributes to enhancing the security and reliability of ICSs by providing a robust and cost-effective solution for anomaly detection. Future work will focus on identifying different types of attacks based on real-world measurement data.